Privacy &
POPIA.

1. Who is responsible for your information

Examo is a product of Umko Solutions (Pty) Ltd (registration number 202192427707), a company incorporated in South Africa. Umko Solutions is the responsible party as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).

Information Officer

Jody Forrester

Email

hello@examo.co.za

2. Learners under 18

Examo is built for high-school learners, and most of them are children in law. POPIA defines a child as anyone under 18, and section 34 prohibits processing a child's personal information unless one of the grounds in section 35 applies. The ground we rely on is section 35(1)(a): the prior consent of a competent person, meaning a parent or legal guardian.

In practice this means:

• During sign-up we ask whether the learner is under 18.
• If they are, we ask for a parent or guardian to confirm consent before the subscription becomes active. In most cases this happens naturally, because the parent is the one paying, and the checkout link is the point at which consent is recorded.
• A parent or guardian may withdraw that consent at any time by messaging us. Withdrawal ends the subscription and triggers deletion under section 9 below.
• We do not encourage or prompt a learner to give us more personal information than the service needs. We never ask for a school name, an address, a photograph or an identity number.

WhatsApp itself requires users to be at least 13 years old. We do not knowingly accept learners below that age, and we will delete the record of anyone we discover to be younger.

3. What we collect

Information	Why we have it
Your WhatsApp mobile number	It is the account. It is how questions reach you and how we recognise you.
Your WhatsApp profile name	So the chat can address you by name.
Curriculum, grade and subject choices	To filter which past papers you are sent. Curriculum is applied before anything is retrieved.
The questions we sent and the answers you typed back	To keep the session coherent, to avoid repeating a question, and to let you carry on where you left off.
Timestamps and message counts	To run the free-question allowance and to see whether the service is working.
Subscription status and payment reference	To know whether your access is active and to reconcile payments.

What we do not collect

We do not collect your identity number, home address, school name, photographs, biometrics, location, or card details. We do not read your other WhatsApp chats, contacts or media — we have no technical ability to do so. We do not buy contact lists or acquire numbers from third parties.

4. Why we are allowed to process it

We rely on the following grounds in section 11 of POPIA:

• Consent — you (or your parent or guardian) chose to start the chat and to subscribe.
• Performance of a contract — we cannot deliver a subscription service without knowing who is subscribed.
• Legal obligation — tax and company records under South African law.
• Legitimate interests — keeping the service secure and preventing abuse of the free allowance.

We do not use your information for automated decision-making that has legal consequences for you.

5. WhatsApp, Meta and our messaging provider

Examo is delivered over the WhatsApp Business Platform. Two third parties are involved in getting a message to your phone.

360dialog is our WhatsApp Business Solution Provider. They operate the technical connection between Examo and WhatsApp and act as an operator under POPIA, processing information only on our instructions and under a written agreement.

Meta Platforms operates WhatsApp itself. Your use of WhatsApp is governed by WhatsApp's own terms and privacy policy, which we do not control. Meta processes message metadata and delivery information according to those terms.

You are consenting to receive messages from Examo when you start the chat or subscribe. We will only send you messages about your study sessions, your subscription and your account. You can stop them at any time by replying STOP, and we will honour that immediately.

6. Payments

Payments are processed by Paystack. When you pay, you are taken to a checkout page hosted by Paystack, and your card details are entered there, not in the Examo chat and not on this website.

• Examo never sees, receives or stores your full card number, expiry date or CVV.
• Paystack is responsible for PCI DSS compliance on card data.
• South African card transactions are verified through 3D Secure with your bank on the first payment.
• After that first payment we store a payment authorisation token issued by Paystack. It lets us charge the agreed monthly amount and nothing else. It is not a card number and cannot be used anywhere but Paystack.
• We store the amount, date, status and reference of each payment for accounting purposes.

Paystack processes your information under its own privacy policy as our operator for payment purposes.

7. Who else we share with

We do not sell your personal information. We do not share it for advertising. We share it only with:

• Our messaging provider and Meta, to deliver messages (section 5).
• Paystack, to take payment (section 6).
• Our hosting and infrastructure providers, who store the data on our instruction.
• Professional advisers and authorities, where the law requires it.

Every operator is bound by a written agreement requiring them to process the information only for us, and to secure it.

8. Information leaving South Africa

Some of our infrastructure providers store data outside South Africa. Section 72 of POPIA permits this where the recipient is subject to a law or binding agreement that provides an adequate level of protection, or where the data subject consents. We rely on written agreements with each provider that impose protections substantially similar to POPIA.

Because most of our users are children, we treat cross-border transfers with extra care. Section 57 of POPIA requires prior authorisation from the Information Regulator before transferring the personal information of children to a country without adequate protection, and we will not transfer children's information to any such country.

9. How long we keep it

Active subscription

For as long as the subscription runs.

After cancellation

Study history is deleted within 90 days unless you ask us to keep it so you can return.

Payment records

Five years, as required by South African tax and company law.

On request

Deleted as soon as we can, except where we are legally obliged to keep a record.

10. Your rights

Under sections 23, 24 and 11(3) of POPIA you have the right to:

• Ask what personal information we hold about you and get a copy of it.
• Ask us to correct anything that is wrong.
• Ask us to delete information that is out of date, inaccurate, or that we no longer have a reason to keep.
• Object to processing on reasonable grounds.
• Withdraw consent at any time. Withdrawal does not undo processing that already lawfully happened.
• Complain to the Information Regulator.

Message us on WhatsApp or email hello@examo.co.za. There is no charge for a straightforward request, and we aim to answer within 30 days. A parent or guardian may exercise these rights on behalf of a learner under 18.

The Information Regulator

Website

inforegulator.org.za

Complaints

complaints.IR@inforegulator.org.za

General

enquiries@inforegulator.org.za

11. Security

We take appropriate, reasonable technical and organisational measures as required by section 19 of POPIA: encrypted connections, access controls, restricted administrative access, and separation of payment handling into Paystack. No system is perfect. If a breach compromises your personal information we will notify you and the Information Regulator as soon as reasonably possible, as section 22 requires.

12. Cookies

This website does not set tracking or advertising cookies. The service runs in WhatsApp, so there is nothing to track here. We load web fonts from Google Fonts, which involves a request to Google's servers.

13. Changes

If we change this policy we will update the date at the top. If a change materially affects how we handle your information, we will tell you in the chat before it takes effect.

This policy explains our practices in plain language. It is not legal advice, and it does not limit any right you have under POPIA, the Consumer Protection Act or any other law.